1

Windows has a pretty good signature system. I was wondering if Android has a signature system for APKs.

If this would be the case, are they self signed? Are the play store apps signed by Google in any way?

Is it possible using this signature detection to detect if an app is from the Play Store?

2
  • It sounds like you're asking us to teach you all about Android code signing. That is too broad a question. What problem are you trying to solve? Jun 8, 2016 at 3:45
  • @NeilSmithline Mainly verification that the app is from Play Store or Google and not backdoored or sideloaded spyware or malware.
    – user76223
    Jun 8, 2016 at 4:57

1 Answer 1

4

All android apps must be signed by developers using self-signed certificates or by third-parties, such as an OEM, mobile operator, or alternate market. When apps are updated, the updated versions must be signed by the same developer. Additionally, applications can share permissions if they are signed by the same developer.

Apps on Google Play are also signed by Google Play. By default, Android blocks the installation of apps that are not signed by Google Play, unless the user has specifically enabled the "Unknown Sources" option under Security Settings.


References:

https://source.android.com/security/overview/app-security.html#application-signing https://developer.android.com/distribute/tools/open-distribution.html https://developer.android.com/studio/publish/app-signing.html

1
  • If you possible can you add the code signature verification method as asked in the question. Also what type of signature is used? GPG?
    – user76223
    Jun 9, 2016 at 5:45

You must log in to answer this question.